Re: NULL pointer deref when running BPF monitor program (6.11.0-rc1)

[Steven Rostedt]

On Wed, 9 Oct 2024 17:33:31 -0700
Josh Poimboeuf <jpoimboe@xxxxxxxxxx> wrote:

> > Hi Josh,
> > we'd like to have information on which of tracepoint's arguments can be NULL
> > 
> > Steven had an idea that objtool could help with that by doing something like
> > what's described above.. would you have any thoughts on that?  
> 
> Objtool doesn't know anything about function arguments, I'm not sure how
> this could be done unless I'm missing something.

I was thinking if something like objtool (could be something else that can
read the executable code) and know of where functions are. It could just
see if anything tests rdi, rsi, rdx, rcx, r8 or r9 (or their 32 bit
alternatives) for NULL before using or setting it.

If it does, then we know that one of the arguments could possibly be NULL.

-- Steve